From 79c59a30b5e7dd7d093e9d3c759848792211f8ee Mon Sep 17 00:00:00 2001 From: David Benjamin Date: Sat, 19 Sep 2015 13:35:39 -0400 Subject: size_t RSA_private_decrypt's input. Change-Id: If05761052e235b38d9798b2fe4d8ba44293af891 Reviewed-on: https://boringssl-review.googlesource.com/5944 Reviewed-by: Adam Langley --- crypto/rsa/rsa.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) (limited to 'crypto') diff --git a/crypto/rsa/rsa.c b/crypto/rsa/rsa.c index 2f23165c..63eb170c 100644 --- a/crypto/rsa/rsa.c +++ b/crypto/rsa/rsa.c @@ -56,6 +56,7 @@ #include +#include #include #include @@ -240,7 +241,7 @@ int RSA_decrypt(RSA *rsa, size_t *out_len, uint8_t *out, size_t max_out, padding); } -int RSA_private_decrypt(int flen, const uint8_t *from, uint8_t *to, RSA *rsa, +int RSA_private_decrypt(size_t flen, const uint8_t *from, uint8_t *to, RSA *rsa, int padding) { size_t out_len; @@ -248,6 +249,10 @@ int RSA_private_decrypt(int flen, const uint8_t *from, uint8_t *to, RSA *rsa, return -1; } + if (out_len > INT_MAX) { + OPENSSL_PUT_ERROR(RSA, ERR_R_OVERFLOW); + return -1; + } return out_len; } -- cgit v1.2.3